Network fault manager for maintaining alarm conditions

Abstract

A computer-implemented method for detecting alarm conditions, the method involving receiving at a first time a trigger notification describing a monitored occurrence on a network; setting a redundancy window to begin at the first time and to end at an expiration time; designating a first alarm condition to represent the trigger notification; receiving a second notification at a second time after the first time, the second notification describing the monitored occurrence; and determining whether a second alarm condition exists by testing whether the second time is within the redundancy window.

1. A computer-implemented method for detecting alarm conditions, the method comprising:
 receiving a first trigger event notification for a monitored occurrence on a network; 
 asserting a first alarm condition to represent the first trigger event notification; 
 receiving a next trigger notification after the first trigger event notification, the next trigger event notification also for the monitored occurrence; 
 determining whether the next trigger event notification occurred within a predetermined amount of time after the first trigger event notification; 
 if the next trigger event notification occurred within a predetermined time after the first trigger event notification, maintaining the first alarm condition; and 
 if the next trigger event notification occurred more than said predetermined amount of time after the first trigger event notification, asserting a second alarm condition to represent the next trigger event notification. 
 
     
     
       2. The method of  claim 1  further comprising:
 establishing a redundancy window which specifies the predetermined amount of time; 
 if said next trigger event notification occurs more than said predetermined amount of time after the first trigger event notification, detecting that the redundancy window has elapsed without an occurrence of a subsequent trigger event notification; and 
 upon detecting that the redundancy window has elapsed without the occurrence of a subsequent trigger event notification, clearing the first alarm condition. 
 
     
     
       3. The method of  claim 2 , wherein maintaining the first alarm condition further comprises restarting the redundancy window based on when said next trigger event notification was received. 
     
     
       4. The method of  claim 1 , wherein the first trigger event notification and said next trigger event notification are traps. 
     
     
       5. A computer-implemented method for detecting alarm conditions, the method comprising:
 periodically sampling the rate at which similar trigger event notifications arrive, wherein the trigger event notifications are for monitored occurrences on a network; 
 comparing the sampled rate to a first threshold; 
 periodically computing N, wherein N is the number of sampled rates within a preceding window of time that exceed said first threshold; 
 each time N is computed, performing the operations of:
 (a) comparing N to a second threshold; 
 (b) if N is greater than said second threshold and if a preexisting alarm condition does not exist, asserting a first alarm condition; and 
 (c) if N is greater than said second threshold and if the preexisting alarm condition does exist, maintaining the preexisting alarm condition for a predetermined future period of time. 
 
 
     
     
       6. The computer-implemented method of  claim 5  wherein the operations further include (d) if N is not greater than the second threshold and if a preexisting alarm condition does exist and if the predetermined amount of time has elapsed since the immediately preceding last time that N exceeded the second threshold, clearing the preexisting alarm condition. 
     
     
       7. The method of  claim 5 , wherein the trigger event notifications are traps. 
     
     
       8. The method of  claim 5 , wherein the first threshold is zero. 
     
     
       9. The method of  claim 5 , wherein the first threshold is greater than zero. 
     
     
       10. The method of  claim 5 , wherein the second threshold varies as a function of time. 
     
     
       11. The method of  claim 10 , further comprising computing the second threshold based on past performance of a parameter that is represented by the trigger event notification. 
     
     
       12. A computer-implemented method for detecting alarm conditions, the method comprising:
 periodically sampling the rate R i  at which similar trigger event notifications arrive, wherein the trigger event notifications are for monitored occurrences on a network, and wherein R i  is the sampled rate at time i; 
 comparing the sampled rate R i  to a first threshold; 
 for each sampled rate R i  that exceeds the first threshold, computing an amount M i  by which the sampled rate R i  exceeds said first threshold; 
 periodically computing T i  which is a sum of M i  for all sample times i within a preceding window of time; 
 for each T i  that is computed, performing the operations of:
 (a) comparing T i  to a second threshold; 
 (b) if T i  is greater than said second threshold and if a preexisting alarm condition does not exist, asserting a first alarm condition; and 
 (c) if T i  is greater than said second threshold and if the preexisting alarm condition does exist, maintaining the preexisting alarm condition for a predetermined future period of time. 
 
 
     
     
       13. The computer-implemented method of  claim 12  wherein the operations further include (d) if T i  is not greater than the second threshold and if a preexisting alarm condition does exist and if the predetermined amount of time has elapsed since the immediately preceding last time that T i  exceeded the second threshold, clearing the preexisting alarm condition. 
     
     
       14. The method of  claim 13 , wherein the trigger event notifications are traps. 
     
     
       15. The method of  claim 13 , wherein the first threshold is zero. 
     
     
       16. The method of  claim 13 , wherein the first threshold is greater than zero. 
     
     
       17. The method of  claim 13 , wherein the second threshold varies as a function of time. 
     
     
       18. The method of  claim 17 , further comprising computing the second threshold based on past performance of a parameter that is represented by the trigger event notification.